Rotate a key
Replace a key's secret without downtime: a new key with the same name, project, environment, Directives, permissions and expiry, while the old key keeps working for the overlap and then expires.
Headers
- Idempotency-Keystringoptional
Optional, up to 255 visible characters (a UUID). A retry with the same key and body within 24 hours makes nothing new; see Idempotent retries.
Body
application/json, optional- overlap_secondsintegeroptional
How long the old key keeps working: 0 to 604800 (7 days), default 86400.
0revokes it now. An old key that already expires sooner keeps its expiry.
Response
- id, secretstringrequired
The new key and its secret, shown once. The new key has a new id.
- previousobjectrequired
The old key, with its new
expires_at(orstatus: "revoked").
Notes
- Budgetsoptional
A key-level budget carries on: the new key and the old one (during the overlap) spend from the same day and month periods, so the budget doesn't restart and nothing is counted twice.
- Auditoptional
One
key.rotateevent on the new key, naming the old.